Defender Identity Now Defends PrintNightmare

Microsoft has included assistance for Print Nightmare exploitation discovery to Microsoft Defender for Identity to aid Security Operations groups find aggressors’ efforts to abuse this vital susceptibility.

This vital problem allows aggressors to take control of damaged web servers by boosting benefits to Domain Administrator, taking domain name qualifications, as well as disperse malware as a Domain Admin using remote code implementation (RCE) with SYSTEM benefits.

Microsoft Defender for Identity (formerly called Azure Advanced Threat Protection or Azure ATP) is a cloud-based safety option that leverages on-premises Active Directory signals. This permits SecOps groups to find as well as explore endangered identifications, progressed dangers, as well as harmful expert task targeting registered orgs.

Last week, Microsoft cleared up the Print Nightmare spot advice as well as shared the actions required to properly spot the vital susceptibility after numerous safety scientists identified the spots provided to deal with the insect were insufficient.

Earlier, Defender for Identity was upgraded in November to find Zero logon exploitation as component of on-premises attacks trying to this vital susceptibility. Still the work in progress to close out the issue permanently till that time Microsoft recommends admins to disable the Print Spooler solution on Windows tools revealed to attacks.